CYBERSPAN^® leverages a sophisticated combination of supervised and unsupervised machine learning techniques to detect threats. It uses advanced analytics to identify anomalies and cyberattacks—even without prior knowledge of a network’s normal activity.

CYBERSPAN^® is deployed as a network sensor and can be installed in three ways:

• Physical: Hardware installed directly on the network
• Virtual: Runs on virtualized resources within the local network
• Cloud: Monitors traffic in a cloud environment

CYBERSPAN^® analyzes network traffic through a direct connection to a customer's networking hardware, typically via a SPAN or Mirror port. This connection sends raw packet traffic to CYBERSPAN® for ingestion and analysis.

CYBERSPAN^® works as a standalone Network Detection and Response (NDR) platform, but it also integrates easily via API with existing SIEMs, threat intel platforms, and logging systems. Event data can be exported in STIX or CSV in addition to API access for easy interoperability with SIEMs such as Elastic.

CYBERSPAN^® uses a controlled, continuous learning approach. Each deployment starts with a burn-in period to baseline "normal" behavior, after which models are retrained on-prem incrementally using validated data, preventing unintentional drift.

All AI processing occurs locally; nothing is sent to the cloud. Models are sandboxed within the appliance, and updates are securely signed and controlled by IntelliGenesis. No public exposure of model logic or training data occurs.

CYBERSPAN^® is not an EDR. It is an agentless NDR platform that monitors network traffic through SPAN or mirrored ports, allowing visibility into anomalies without installing anything on individual endpoints.